Exploitation Summary
EIP tracks 2 public exploits for CVE-2019-11409.
PoCs published by Metasploit, Dustin Cobb, bcoles, including Metasploit module exploits/unix/webapp/fusionpbx_operator_panel_exec_cmd_exec.
AI-analyzed exploit summary This Metasploit module exploits an authenticated command injection vulnerability in FusionPBX versions 4.4.3 and prior via the `exec.php` file in the Operator Panel. It allows execution of arbitrary commands as the web server user by leveraging the FreeSWITCH event socket interface.
Description
app/operator_panel/exec.php in the Operator Panel module in FusionPBX 4.4.3 suffers from a command injection vulnerability due to a lack of input validation that allows authenticated non-administrative attackers to execute commands on the host. This can further lead to remote code execution when combined with an XSS vulnerability also present in the FusionPBX Operator Panel module.
Exploits (2)
This Metasploit module exploits an authenticated command injection vulnerability in FusionPBX versions 4.4.3 and prior via the `exec.php` file in the Operator Panel. It allows execution of arbitrary commands as the web server user by leveraging the FreeSWITCH event socket interface.
This Metasploit module exploits an authenticated command injection vulnerability in FusionPBX versions 4.4.3 and prior via the `exec.php` file in the Operator Panel. It allows execution of arbitrary commands as the web server user by leveraging the FreeSWITCH event socket interface.
References (4)
Scores
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H